maybe add TODO comments about the unicode workaround? once we have private data running through here this is leaking data to the browser that should all stay server side...